Study workspace

Prepare for SC-200 with a reference that remembers your progress.

All nine learning paths now run in the new architecture. Select one to reveal its brief and modules.

09 / 09

Choose a learning path

0/404 units
04Create queries for Microsoft Sentinel using KQL4 modules · 29 units · Query construction, aggregation, visualization, multi-table analysis, parsing, and reusable functions0/29 units complete−
Learning path 04 · Create queries for Microsoft Sentinel using KQL ↗

4 modules · 29 units · Query construction, aggregation, visualization, multi-table analysis, parsing, and reusable functions

0%

Study focus

KQL foundations

Build statements with filtering, projection, aggregation, time operations, and visualization.

Investigation queries

Analyze multi-table data with joins, unions, parsing, reusable functions, and Sentinel security context.

4 modules · 29 units

Select one or more modules

Each click adds or removes a module from your workspace. Units remain closed until you open them.

End of learning pathCreate queries for Microsoft Sentinel using KQL
↑